CVE-2025-46654

CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uploaded .js file...

CVE-2025-46654

creationtimestamp| type| source ---|---|--- 2025-04-26 21:09:39+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13586 2025-04-26 21:37:10+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lnqow6hszp72 2025-04-26...

CVE-2025-46654

CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uploaded .js file...